Next.js: Denial of Service in the Image Optimization API using SVGs

CVE-2026-64644

### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely ho

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Unauthenticated disclosure of internal Server Function endpoints

CVE-2026-64643

## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be discl

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

CVE-2026-64642

## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Denial of Service in App Router using Server Actions

CVE-2026-64641

## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

CVE-2026-65589

## Impact Custom HTTP headers configured in credentials for certain LLM sub-nodes (including OpenAI, Anthropic, and Lemo

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

CVE-2026-65014

## Impact The `DELETE /${restEndpoint}/test-webhook/:id` route is registered before the authentication middleware is app

历史摘要 · 未重新核验 · GitHub Advisory

n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

CVE-2026-65596

## Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (suc

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

CVE-2026-65594

## Impact The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated

历史摘要 · 未重新核验 · GitHub Advisory

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

CVE-2026-65590

## Impact The shell tool in the `@n8n/computer-use` package applied its sandbox restrictions only on macOS. On Linux and

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

CVE-2026-58661

## Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

CVE-2026-59253

## Impact An authenticated user with permission to create workflows in one project could bypass project/folder authoriza

历史摘要 · 未重新核验 · GitHub Advisory

n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

CVE-2026-59254

## Impact External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be ava

历史摘要 · 未重新核验 · GitHub Advisory

n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

CVE-2026-59257

## Impact The legacy MySQL v1 node's `executeQuery` operation substitutes evaluated `{{ ... }}` expression values direct

历史摘要 · 未重新核验 · GitHub Advisory

n8n: External Secrets Permission Bypass via Expression Parser Mismatch

CVE-2026-59259

## Impact Due to a mismatch between the static validation check and the runtime expression engine, an authenticated user

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

## Impact The component `@n8n/computer-use` file-search tool confined searches to a configured base directory. A crafte

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

## Impact An authenticated user able to create or edit a workflow expression could abuse the expression engine's array-

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

## Impact The Edit Fields (Set) node assigned output fields through a dot-notation path setter without restricting the

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Edit Image Node Format Injection Allows Arbitrary File Write

## Impact The n8n Edit Image node passed its output format to the underlying image library without validation, so a cra

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced insi

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

## Impact An authenticated member with edit access to a shared workflow could reference another user's credential in an

历史摘要 · 未重新核验 · GitHub Advisory